The most common procurement fraud mechanism in Indian mid-market companies is the vendor that is owned, controlled or influenced by a company employee. The employee creates or directs business to a vendor in which they have a financial interest. The vendor receives the company's payments. The employee receives the vendor's profits.
The mechanism is simple. The detection, through traditional audit methods, is difficult, because the connection between the employee and the vendor exists in data that the company possesses but has never cross-referenced.
The Data Intersection Methodology
The Employee-Vendor Connection Test works by cross-referencing two datasets that normally sit in separate systems: the employee master data and the vendor master data.
Employee master data: Name, address, phone number, email address, PAN, bank account number (for salary credit), emergency contact details, previous employer, family members listed as insurance beneficiaries or emergency contacts.
Vendor master data: Entity name, registered address, contact phone number, contact email, PAN, bank account number (for payment credit), directors (from MCA filings), shareholders.
The cross-reference identifies matches across every comparable field:
Address match: An employee and a vendor sharing the same address is not proof of fraud. It is a flag that requires investigation. The employee may live in a commercial complex. Or the employee may operate the vendor from their home.
Phone number match: An employee and a vendor sharing the same phone number is a stronger indicator. A phone number is personal and specific. A match suggests that the same person is contactable through both the company's employee channels and the vendor's business channels.
Bank account match: An employee and a vendor sharing the same bank account is the strongest single indicator. It means that the company's vendor payment is credited to the same account as the employee's salary. The financial benefit flows directly to the employee.
PAN match: An employee and a sole proprietor vendor sharing the same PAN means they are the same person. The employee is the vendor.
Email domain match: An employee and a vendor sharing the same non-generic email domain (not Gmail or Yahoo, but a company-specific domain) suggests the employee controls or is associated with the vendor's email infrastructure.
Family member match: A vendor whose director or shareholder matches the name of an employee's listed family member (spouse, parent, sibling from insurance or emergency contact records) suggests that the vendor is operated by the employee's family.
The Analytics Process
In Northrop Management Private Limited's forensic analytics practice, the Employee-Vendor Connection Test is executed as a systematic, automated process.
Step 1: Extract and cleanse. Extract complete employee master data and vendor master data. Cleanse both datasets: standardise address formats, normalise phone numbers (remove country codes, spaces, dashes), standardise name formats.
Step 2: Cross-reference every field. Run automated matching across every comparable field pair: employee address vs vendor address, employee phone vs vendor phone, employee PAN vs vendor PAN, employee bank account vs vendor bank account, employee name vs vendor director/shareholder name, employee family member name vs vendor director/shareholder name, employee email vs vendor email.
Step 3: Score matches. A single-field match is a flag. Multi-field matches are escalated: an address match plus a phone match is a stronger signal than either alone. A bank account match is the highest-confidence indicator.
Step 4: Investigate flagged connections. For each match, determine the explanation. Some will be legitimate (an employee who previously worked for a vendor, a vendor located in the same residential complex as an employee). Some will require further investigation (an employee whose spouse is a director of a vendor that receives Rs 50 lakh per year in procurement).
Step 5: Quantify the exposure. For confirmed connections, calculate the total procurement value flowing to connected vendors. Assess the pricing: is the connected vendor's pricing at, above or below market rates? A connected vendor receiving above-market pricing creates both a conflict-of-interest issue and a financial loss.
Step 6: Assess control implications. Did the connected employee have any role in the vendor selection, purchase order approval, goods receipt or payment processing? If yes, the segregation of duties was compromised, and the control environment failed to prevent the conflict.
What the Test Typically Reveals
In Northrop Management Private Limited's forensic experience, the Employee-Vendor Connection Test produces actionable findings in the majority of engagements where it is applied. The most common findings:
Employees operating sole proprietorship vendors. The employee and the vendor share the same PAN. The employee processes purchases through their own vendor entity, sometimes approving their own purchase orders.
Family-operated vendors. A vendor whose director is the spouse, parent or sibling of an employee who works in the procurement or operations function. The employee influences the vendor selection or purchase volume through their role.
Shared bank accounts. Vendor payments credited to accounts that also receive the employee's salary. The financial benefit is direct and undeniable.
Shared contact details. The vendor's registered phone number is the employee's personal mobile. The vendor's email address is the employee's personal email.
The total procurement value flowing through connected vendors, when aggregated across all findings, typically ranges from 2% to 8% of total procurement in mid-market companies that have not previously conducted this analysis. The financial impact, measured as the premium paid above market rates to connected vendors, typically ranges from 0.5% to 2% of total procurement.
Ashish Chaudhary, Founder and Managing Director of Northrop Management Private Limited, frames the analytical power directly: "Hidden relationships often surface at the intersection of datasets. An employee record and a vendor record, examined separately, reveal nothing. Examined together, cross-referenced across address, phone, PAN, bank account and family connections, they reveal relationships that the company's control environment was not designed to detect. The data exists in the company's own systems. The question is whether anyone has ever looked at it."
Questions for the Boardroom
- Have we ever cross-referenced our employee master data against our vendor master data across all comparable fields?
- Do any of our vendors share an address, phone number, PAN, bank account or director/shareholder with any of our employees?
- For each connected vendor identified, what is the total procurement value, and how does the pricing compare to independent vendors for the same goods or services?
- Do employees with procurement authority have access to create or modify vendor records in the ERP system?
- Is the Employee-Vendor Connection Test included in our annual internal audit plan, or has it never been performed?
Closing Implication
The Employee-Vendor Connection Test is one of the highest-yield forensic analytics procedures available to any company, because it examines a specific, common, financially material fraud mechanism using data the company already possesses. The test requires no external data, no special access and no investigative authority beyond the company's own employee and vendor records.
The findings are either reassuring (no connections exist, and the procurement function is operating with integrity) or actionable (connections exist, and the company now knows which vendors, which employees and which procurement values are affected). Either outcome is valuable. The first confirms control effectiveness. The second identifies a problem the company did not know it had, using data it always possessed but never examined.
